Vibe-Coding Security

# Slopsquatting — registering packages that LLMs HALLUCINATE.
# (Spracklen et al., USENIX Security 2025 + Lasso Security research.)
# 19.7% of LLM-suggested package names in the study were non-existent;
# attackers register the most common hallucinations on PyPI/npm.

# Attacker workflow:
#  1. Mass-prompt models for "give me a Python package that does X"
#     across thousands of tasks; collect every package name suggested.
#  2. Diff against the real PyPI/npm index.
#  3. Register the missing names with a malicious payload.
#  4. Wait for vibe-coded `pip install <hallucinated>` runs.

# Real-world examples already seen in the wild (2024-2025):
#  - 'huggingface-cli' typo squatters
#  - 'jellyfin-client' (LLM-suggested but didn't exist on PyPI)
#  - dozens of 'requests-*' helpers

# Defenses:
#  * Pin to lockfiles only (poetry.lock, pnpm-lock.yaml, Cargo.lock).
#  * Block agents from running 'pip install' / 'npm install' without approval.
#  * Use 'pip-audit', 'npm audit signatures', sigstore/cosign verification.
#  * Run a private mirror that allowlists known-good packages.

# .vscode/settings.json — sensible defaults for vibe-coding tools
{
  // GitHub Copilot Chat / agent mode
  "chat.tools.terminal.autoApprove": false,
  "chat.tools.edits.autoApprove": false,
  "github.copilot.chat.codeGeneration.useInstructionFiles": true,
  "github.copilot.chat.codeGeneration.instructions": [
    { "file": ".github/copilot-instructions.md" }
  ],

  // Cursor
  "cursor.cpp.disabledLanguages": [],
  "cursor.general.enableAutoApply": false,
  "cursor.composer.shouldAllowCustomModes": false,

  // Continue.dev
  "continue.telemetryEnabled": false,

  // Codespaces / devcontainer
  "remote.SSH.useLocalServer": true,

  // Block .env / secrets from being read by ANY tool
  "files.exclude": { "**/.env": true, "**/.env.*": true,
                     "**/credentials": true, "**/id_rsa*": true }
}

# Repo policy: refuse to load instruction files from cloned third-party
# repos until they are reviewed by a human. Editor settings
# (files.exclude above) and .git/info/exclude only hide files — agents
# still load them — so quarantine unreviewed files with a pre-commit hook:
#   .cursor/rules/          (Cursor 0.45+; legacy .cursorrules also blocked)
#   .cursorrules
#   AGENTS.md
#   CLAUDE.md
#   .github/copilot-instructions.md
# (Quarantine by default; opt in per repo after human review.)